@rigour-labs/core 6.4.1 → 6.4.2

package/dist/gates/deep-analysis.d.ts

@@ -55,3 +55,6 @@ export declare class DeepAnalysisGate extends Gate {
     private createCloudAgent;
     private toFailure;
 }
+/** Per-call options; unset config falls back to per-provider defaults. */
+/** Per-call inference timeout: a local 7B reads a file with its reference pack far slower than the small tiers. */
+export declare function defaultTimeout(options: DeepOptions): number;

package/dist/gates/deep-analysis.js

@@ -175,12 +175,18 @@ function isCloud(options) {
     return !!options.apiKey && !!options.provider && options.provider !== 'local';
 }
 /** Per-call options; unset config falls back to per-provider defaults. */
+/** Per-call inference timeout: a local 7B reads a file with its reference pack far slower than the small tiers. */
+export function defaultTimeout(options) {
+    if (isCloud(options))
+        return 120_000;
+    return options.max ? 240_000 : 60_000;
+}
 function inferenceOptions(config) {
     const cloud = isCloud(config.options);
     return {
         maxTokens: config.maxTokens ?? (cloud ? 4096 : 1024),
         temperature: config.temperature ?? 0.1,
-        timeout: config.timeoutMs ?? (cloud ? 120_000 : 60_000),
+        timeout: config.timeoutMs ?? defaultTimeout(config.options),
         jsonMode: true,
     };
 }

package/dist/gates/deep-timeout.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/deep-timeout.test.js

@@ -0,0 +1,10 @@
+import { describe, expect, it } from 'vitest';
+import { defaultTimeout } from './deep-analysis.js';
+describe('deep inference timeout', () => {
+    it('gives the local 7B tier four minutes a call, the small tiers one, and cloud two', () => {
+        expect(defaultTimeout({ enabled: true })).toBe(60_000);
+        expect(defaultTimeout({ enabled: true, pro: true })).toBe(60_000);
+        expect(defaultTimeout({ enabled: true, max: true })).toBe(240_000);
+        expect(defaultTimeout({ enabled: true, apiKey: 'k', provider: 'claude' })).toBe(120_000);
+    });
+});

package/dist/gates/logic-drift.d.ts

@@ -3,9 +3,14 @@
  *
  * Detects when AI subtly changes business logic in functions:
  * - Comparison operator mutations: >= became > (off-by-one)
- * - Return statement additions/removals
- * - Branch count changes (new if/else added or removed)
- * - Call sequence changes (function calls reordered)
+ * - Return statement additions/removals (opt-in: track_returns)
+ * - Branch count changes, new if/else added or removed (opt-in: track_branches)
+ *
+ * Return and branch counts are off by default: a change that edits a function
+ * usually changes them on purpose, so they fired on almost every edited function
+ * without saying what was wrong. Judged against review comments developers acted
+ * on, 0 of 7 such findings raised the reviewer's issue. An operator mutation is
+ * specific and actionable, so it stays on.
  *
  * This is the HARDEST drift to catch because:
  * - Code still compiles

package/dist/gates/logic-drift.js

@@ -3,9 +3,14 @@
  *
  * Detects when AI subtly changes business logic in functions:
  * - Comparison operator mutations: >= became > (off-by-one)
- * - Return statement additions/removals
- * - Branch count changes (new if/else added or removed)
- * - Call sequence changes (function calls reordered)
+ * - Return statement additions/removals (opt-in: track_returns)
+ * - Branch count changes, new if/else added or removed (opt-in: track_branches)
+ *
+ * Return and branch counts are off by default: a change that edits a function
+ * usually changes them on purpose, so they fired on almost every edited function
+ * without saying what was wrong. Judged against review comments developers acted
+ * on, 0 of 7 such findings raised the reviewer's issue. An operator mutation is
+ * specific and actionable, so it stays on.
  *
  * This is the HARDEST drift to catch because:
  * - Code still compiles
@@ -34,8 +39,8 @@ export class LogicDriftGate extends Gate {
             enabled: config.enabled ?? true,
             baseline_path: config.baseline_path ?? '.rigour/logic-baseline.json',
             track_operators: config.track_operators ?? true,
-            track_branches: config.track_branches ?? true,
-            track_returns: config.track_returns ?? true,
+            track_branches: config.track_branches ?? false,
+            track_returns: config.track_returns ?? false,
         };
     }
     get provenance() { return 'ai-drift'; }

package/dist/gates/logic-drift.test.js

@@ -35,6 +35,13 @@ describe('LogicDriftGate Git baseline', () => {
         git('merge', '-q', '--ff-only', 'feature');
         expect(await gate.run({ cwd })).toEqual([]);
     }, 30_000);
+    it('reports return and branch count changes only when opted in', async () => {
+        git('switch', '-q', '-c', 'feature');
+        fs.writeFileSync(path.join(cwd, 'src/rules.ts'), 'export function eligible(score: number) {\n  if (score < 0) return false;\n  if (score > 100) return false;\n  return score >= 10;\n}\n');
+        expect(await new LogicDriftGate().run({ cwd })).toEqual([]);
+        const opted = await new LogicDriftGate({ track_returns: true, track_branches: true }).run({ cwd });
+        expect(opted.map(f => f.title).sort()).toEqual(['Logic Drift: Branch Change', 'Logic Drift: Return Change']);
+    }, 30_000);
     it('does not use a moving local snapshot when Git has no main reference', async () => {
         git('switch', '-q', '-c', 'feature');
         git('branch', '-D', 'main');

package/dist/gates/promise-safety.js

@@ -104,7 +104,9 @@ export class PromiseSafetyGate extends Gate {
                 // Also count .then().then().catch() chains — the catch at the end covers all
                 if (j > i && braceDepth < 0)
                     break; // Exited enclosing scope
-                if (j > i && /^(?:const|let|var|function|class|export|import|if|for|while|return)\b/.test(lookahead.trim()))
+                // A statement keyword ends the chain only at the chain's own depth; inside the
+                // .then callback's body (depth > 0) `if`/`return` belong to the callback.
+                if (j > i && braceDepth <= 0 && /^(?:const|let|var|function|class|export|import|if|for|while|return)\b/.test(lookahead.trim()))
                     break;
             }
             if (!hasCatch && !isInsideTryBlock(lines, i) && !/(?:const|let|var)\s+\w+\s*=/.test(line)) {

package/dist/gates/promise-safety.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/promise-safety.test.js

@@ -0,0 +1,34 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { PromiseSafetyGate } from './promise-safety.js';
+describe('PromiseSafetyGate unhandled .then', () => {
+    let cwd;
+    beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'promise-safety-')); });
+    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
+    async function thenFindings(code) {
+        fs.writeFileSync(path.join(cwd, 'session.ts'), code);
+        const failures = await new PromiseSafetyGate().run({ cwd });
+        return failures.filter(f => f.details.includes('unhandled-then')).length;
+    }
+    it('flags a .then chain with no .catch', async () => {
+        expect(await thenFindings('export function wake(p: Promise<number>) {\n  p.then(n => {\n    if (n > 1) log(n);\n  });\n}\ndeclare function log(n: number): void;\n')).toBe(1);
+    });
+    it('finds the .catch that closes a chain whose callback body has if and return statements', async () => {
+        const code = [
+            'export function wake(accepted: Promise<{ action: string }>) {',
+            '  void accepted',
+            '    .then(result => {',
+            "      if (result.action === 'wake') {",
+            '        return run();',
+            '      }',
+            '      return undefined;',
+            '    })',
+            '    .catch(() => {});',
+            '}',
+            'declare function run(): Promise<void>;',
+        ].join('\n');
+        expect(await thenFindings(code)).toBe(0);
+    });
+});

package/dist/gates/security-patterns-data.js

@@ -67,7 +67,8 @@ export const VULNERABILITY_PATTERNS = [
     // Hardcoded Secrets
     {
         type: 'hardcoded_secrets',
-        regex: /(?:password|secret|api_key|apikey|auth_token|access_token|private_key)\s*[:=]\s*['"][^'"]{8,}['"]/gi,
+        // A secret literal has no whitespace: `hidePassword: 'Hide password'` is a UI label, not a credential.
+        regex: /(?:password|secret|api_key|apikey|auth_token|access_token|private_key)\s*[:=]\s*['"][^'"\s]{8,}['"]/gi,
         severity: 'critical',
         description: 'Hardcoded secret detected in code',
         cwe: 'CWE-798',

package/dist/gates/security-patterns.test.js

@@ -85,6 +85,14 @@ describe('SecurityPatternsGate', () => {
             const vulns = await checkSecurityPatterns(filePath);
             expect(vulns.some(v => v.type === 'hardcoded_secrets')).toBe(true);
         });
+        it('does not take a UI label that mentions a password for a secret', async () => {
+            const filePath = path.join(testDir, 'be.ts');
+            fs.writeFileSync(filePath, `
+                export default { authForm: { hidePassword: 'Схаваць пароль', showPassword: 'Show the password' } };
+            `);
+            const vulns = await checkSecurityPatterns(filePath);
+            expect(vulns.some(v => v.type === 'hardcoded_secrets')).toBe(false);
+        });
         it('should detect password assignments', async () => {
             const filePath = path.join(testDir, 'auth.ts');
             fs.writeFileSync(filePath, `

package/dist/templates/universal-config.js

@@ -231,8 +231,8 @@ export const UNIVERSAL_CONFIG = {
             enabled: true,
             baseline_path: '.rigour/logic-baseline.json',
             track_operators: true,
-            track_branches: true,
-            track_returns: true,
+            track_branches: false,
+            track_returns: false,
         },
         semantic_bugs: {
             enabled: true,

package/dist/types/index.js

@@ -295,8 +295,8 @@ export const GatesSchema = z.object({
         enabled: z.boolean().optional().default(true),
         baseline_path: z.string().optional().default('.rigour/logic-baseline.json'),
         track_operators: z.boolean().optional().default(true),
-        track_branches: z.boolean().optional().default(true),
-        track_returns: z.boolean().optional().default(true),
+        track_branches: z.boolean().optional().default(false), // opt-in: counts change on purpose in most edits
+        track_returns: z.boolean().optional().default(false), // opt-in: same
     }).optional().default({}),
     // v4.0+ Deep Analysis (LLM-powered)
     deep: z.object({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.4.1",
+  "version": "6.4.2",
   "description": "AI-native quality gate engine with local Bayesian learning. AST analysis, drift detection, Fix Packet generation, and agent self-healing across TypeScript, JavaScript, Python, Go, Ruby, and C#.",
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -67,11 +67,11 @@
     "pg": "^8.16.3",
     "sqlite3": "^5.1.7",
     "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-arm64": "6.4.1",
-    "@rigour-labs/brain-darwin-x64": "6.4.1",
-    "@rigour-labs/brain-linux-x64": "6.4.1",
-    "@rigour-labs/brain-win-x64": "6.4.1",
-    "@rigour-labs/brain-linux-arm64": "6.4.1"
+    "@rigour-labs/brain-darwin-arm64": "6.4.2",
+    "@rigour-labs/brain-darwin-x64": "6.4.2",
+    "@rigour-labs/brain-linux-arm64": "6.4.2",
+    "@rigour-labs/brain-win-x64": "6.4.2",
+    "@rigour-labs/brain-linux-x64": "6.4.2"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",